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3.2 weakness of expanded key 

The MISTYl's compact schedule contributes to high implementing performance. 
However, there are very simple relations among expanded -keys produced by the key 
schedule. Therefore, number of particular plaintexts and complexity for decryption 
attack becomes smaller to perform multiple-step decryption attack. 



If the extended key used by the AND operation contains only zeros and the extended 
key used by the OR operation contains only ones, the output of the FL function is the 
exclusive-or of its input and a constant. Thus, if we fix the extended keys as follows, 



= 0x0000 



(9) 



With this assumption, it is known that value of seventh order difference of MISTY at 
the third round becomes a constant by references fl][3][5]fll][l3}, and this condition is 
calculated back from the key schedule to be the key condition relation to the user key. 
Thus 

AT a = K 2 = 0x0000 

K^K^OxM ( 10 ) 
where 

K 3 =KJ(K 3 ;K 4 ) 

Consequently, decryption attacker need to fix the secret key 
sub-blocks ,K lt K 2 ,K 3 ,K AI K s and AT S . 

However, we can show that the number of fixed secret, key sub-blocks becomes small if 
we use an eighth order differential for the attack. In the case of fixed KL 3 , reference 

[13] shows the degree of the left-most 7 bits in the output of KO z (Z'f ) is 9. 

However, the degree of the left-most 7 bits is 7 analytically, thus. 



A (7 >Z^ = 0x6^ 
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In the case of NOT fixed /a 3 , the formal degree of output of F/ 3I and FI i2 is 
estimated 9,and the formal degree of Z'^ is estimated to be 8. 

Comparing these estimations, we conjecture that the degree of Zj'-' for NOT fixed 

AZ, is 7 but decryption attacker can not specify the value of its seventh order 
differential (see fig 4). 

From the value of higher order differentials, it is easy to see that if A f ' V) Z is constant 

then A'^^Z is equal to 0. Since the attacker cannot specify the value of the seventh 

order differential of Z' 3 Ll , we consider an attack using the eighth order differential. 
Moreover, we consider the case of NOT fixed KL n . Half left bits of the plaintext and 
sub-blocks X 2 and X 3 affect the maximum degree of output. Therefore we cannot 
use them as variable bits. Thus we consider an eighth order differential using X and 

one bit selected from among X } . We confirmed that A m Z'^ = 0 for such an eighth 
order differential by computer simulation. 

The attack equation derived from the equation A m Z'f = 0 has unknowns with respect 
to expanded keys for FL 6 and FO i . However, if we fix the value of the secret key 
sub-block as K 7 = KL a = Oxffff , we have A m Z? = 0 . We can neglect the unknowns 
with respect to the expanded keys for FL 6 . 

Our attack succeeds under the condition that the secret key sub-blocks satisfy 
K 5 =K 7 ^Qxffff 

Therefore it is possible to attack by using eighth order differential at third round. 
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Hidema Tanaka 



NobuyuJd Sugio 
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8 JT/™^^**^ 6 ©Misty 
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-g\ SIM© <fc 5 *S^atfc*Jtt<5^*3WR-i-« C t # 

fceo£?±&9#ft^*to©, ^©^ft-^feaoirt^** 
ft#6\ 4fcfc^e>S^S$^#lc*:i&5 r i Sr3fe«£it 

CI© J: 5 fcmjSlcSTtf, /n j, ^sff#fc*rLrKi^® 

2.2 JKPgS^ [7} 

.X e GF(2)» fcSHBX* K^fc-f S. 
-X = On, a*, . . . , x £ ). = 1, 2, .... n) 6 GF(2J" 

GF(2)- ^KAi-TS. 



(1) 



(At, A 2l . .. , ^) £r GF(2)" _h-c? 1 i ®©^;> h 

^it«. itufef-J:oT5S&it$, GF(2) { ©&#-£; 



F(X & A; K) 



(2) 



(3) 



deg^ {F(X;JT}} 

2.3 i£3£#S:£ 
i STMfM- £3X7t Feiste) *©4Hl§\ F g3«g:ffi;?7fS!j 



»ttf±3£; (3) J: •? 

1 AW^.j^J = const' (4) 
. ^(C L (X);JC i )©C R (X) = 2 i _ 2 (^) (5) 

0^ F(CtU)j JfO © C7r(*) « const 

© f(Cl(x>,k<)®c r (x) =0 (6) 

WOT-, EtTiH^SfcSE^&SCfcispJ?. 

2.4 ft«C««P^ 

6 bit <Dmj> sub-block foiag LT W it£l£-Srffl^T 
as*8**»*tLt, ^*v£>» <©(;:&; jfftjgtj? 

«[9}[10J. ftWMRfett, 1e*i*teJ:*Wfcl**Btft 

*S*5r«?<„ 6 bit© sub-block fc&B UtSS* 

Sfc^fc Li/AJ © N MHft&tt&X&frs. xm [9][10] 

0© F ligtS-Jt^Ki <ts. 
- , .£ feicMcQ s bit £0^*3®: 5 &^g?sgr- 

+*r t lefts. ^tvSfe, fc L a— « i a * 

2"+» x [(£ + a)/6j x £ (BCD F MKftJf £ ft 5. 



-3S4- 
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3 Mi^mtj-^cmm 

3.1 MISTYl 



•,Xa) 



MISTYl fia >^ l f 
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Secret Scey 
sub-block 



a 1: MfSTYl co^-jr-^— t v 



~k6~ u 



KL, 



K 4 (odd i) 



K»-f-3 (even J) 



<KL 3 NOT fixed> 




KL aa =^^=0x0000 
KL S2 = KL 32 = Oxffff 



(9) 



1-45 i , Kiev » < o^Att (1],(3],[5J,[1XJ,[13J fti"C-*ft 

• ^3 = Ka = 0x0000 
■#5 = Kg = Ox/iff (io) 



13 = wcsiijro 



&@SLftimi:ffte>ftt,\, ' i, :J 

i tf-c* &jS+< Kh^mmut^^l *» 



ftv\ i?T, X 0 <0 7bit fc &><bmA,1£ lbit o-g-ff- 

'4 ^ =0 1 ft<s = 4 

JTi^ = ^T 0 ** 5 t ■« U FL S com* izMt* 

fc*** pre* ft 5 ; t«j^^ 
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m 5: i£m%&z<r>^fmmv>m& a, b and c 



3.3 sm&ti-zmi^&m 

frtfeXT'tti^ i£3S!i3«$5SI sub-block £*:£>-5 O T\ * 
S&g£ sub-block *i S-Bwc \3!ZkA s < * 

A< s >Z 3 L7 =A< s >{.X + S} = 0, 

.4 = FL 8 (C R ;KL a )^ 
-.FI.COR-.JSS.Ka) 1 * 

0 = F0 5 (C;K0 5 ,KI 5 ) 1,T _ 

= F0 S (CiK^K'z, Ki [k^ K^Jk?, K|) Li 

C = FL 7 (C L ;KL 7 ) 

-i-FO s (FL s (C R ;i^, iT 8 ); KO s ,KI s ) 
= FL T (C L ;^,K- 4 ) 

H-F0 6 (FL s (C R ;i?4,iir 8 ) 

(12} 

» 8fc«*«sC't'«>+IBIER^B,CB:B5Tf*«, 

K s t Kt (±fS£^g3£§ti,rv^WT? % -g-tf96bit©6-o 
sub-block £r$K £ i $r#x.$ c KO S i, KO<ni,KI 6I 



KO sl ), ff 8 (= K0 62 ),/^(= KI 61 ) «^gcgg^T-S 

**^t«c-f-5, £fcic 7 (= Fr(jr 7 ;f<- a )) x-s>?>^&, 

#&©*fcigsc-ofc3. t:%T, ir, = Ko M i*, salt 

Ka, 2C« Cfi-tf 64 bit) ^-f-^^^sx-^s s„ 
•?rco^m, jq, K 2 , K», Kt, K 6 , ir 6 , fT 7 , Ks *s 
= FI(id; K 2 ) X'h D, = FI(jr j; Jir<), 

iT 4 ) St^Vnt^* 5 - A: tfsx^ 3, 

/B!^cOfe&K-»bfe„ £ = 13,269 T-feS 

ria^tf^fc,,' s = 48 bit ©**pft{cglUT(4^:SS 
.«3?T-;<Ei6SC9X\ a = 64 <2«-« = 2-" «, 1) 
i:l8^-«OjiSjlSTffc5 5. £fcs 7bit Ofctf * sub- 
block .Z^ KSEB b-Xt >5©'C« t = 7-efeS„ tot, 
2 8 x L(33269 + 64)/7J =i 2 ia * ®«5S^3t fc 2 S " MS x 
L(13269 + 64)/7j x 13269 a 2 s4 -« fetbtf, 

4 *t«> 

IC*f-r-5^^ii-cV>r#xL, -t«5—Wtl>X MISTY! 

u 2 sm5^a»teissi**fc»«-te-3V ->r feiS^fc. 

X#fc„ 



—367- 
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%i<bixX^Z>m'0 Skm<ni>cr>-?hZ>. sub-block 

iiCior-t^^ir^PMfJfflbf^ MISTYl i-^co 
SR^S CD KASUMI S±, ^tttfe« St' Z<F>jS<T=r}} <D 

mm*, nm^mm h^m^i. v ^it-c 
1,^ msk^mtii *> fi&mz&jLvt »r«& tecs. 
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